An Ethereum wallet that received its first ether in the network’s genesis block in July 2015 finally sent funds late Monday. The first transfer was small: 0.05 ETH, about $106, to a new address. Whale Alert flagged the move. The old address had also taken in another 755 ETH in March 2016 and had never sent anything out until that test.
The test payment drew bots
The test was the kind of signal address-poisoning bots watch for. Within three minutes, the old wallet began receiving tiny transfers from two lookalike addresses. One started 0x13211f and the other 0x1321FB; both ended in 1A44. The real destination started 0x1321beb8 and also ended in 1A44. Etherscan tags both lookalikes as Fake_Phishing. The busier one sent 43 dust payments, according to the data.
How address poisoning works
Wallet apps often show only the first and last few characters of an address. A scammer creates an address with the same opening and closing characters, then sends dust to the target’s transaction history. If the owner later copies a recent recipient from that history, the money can go to the scammer instead. It works best when someone has just sent a test payment and is about to send the rest. I think that is why the timing here was so tight.
The owner sent the full amount correctly
The owner did not take the bait. The new wallet sent 0.01 ETH onward at 22:20 UTC, and nearly all of it came back three minutes later. Then, at 22:42 UTC, 38 minutes after the first test, the old wallet sent 2,154.94 ETH, roughly $4.6 million, to the correct address. That address now holds about 2,155 ETH.
Dust spam adds to Ethereum activity
Address poisoning has become a volume business. In January, Citi warned that poisoning spam was inflating Ethereum’s record transaction counts, with much of the new activity made up of transfers worth less than $1. That is close to the amounts sprayed at this 2015 wallet. The full transfer went through, but the lookalike payments show how quickly a public test can draw unwanted attention.
